Secure communication between processes in cloud

1. A non-transitory computer-readable medium to store instructions, which when executed by a computer, cause the computer to perform operations comprising:

receiving a request from a client application process hosted in an application virtual machine at a load balancer, wherein the request comprises a client certificate;

establishing a first secure communication channel between the client application process and the load balancer, wherein the first secure communication channel is encrypted with the client certificate;

terminating the first secure communication channel at the load balancer; identify a service process of a service virtual machine based on the request received from the client application process;

sending a new request to the service virtual machine to establish a second secure communication channel between the load balancer and the service process of the service virtual machine, wherein the second secure communication channel is encrypted with a load balancer certificate signed by a certificate authority; and

accepting the second secure communication channel at the service virtual machine establishing a secure communication between the client application process and the service process, upon successful validation of the load balancer certificate.

2. The computer-readable medium of claim 1 , to store instructions, which when executed by the computer, cause the computer to perform operations further comprising:

retrieving the client certificate from the request at the service virtual machine;

validating the client certificate at an application filter installed at the service virtual machine; and

establishing the second secure communication channel between the load balancer and the service virtual machine, upon successful validation of the client certificate.

3. The computer-readable medium of claim 2 , wherein the client certificate comprises attribute information including at least one of a host name, an account name, an application name, permission flags and a tenant identifier.

4. The computer-readable medium of claim 3 , wherein validation of the client certificate is based on the certificate attributes.

5. The computer-readable medium of claim 3 , to store instructions, which when executed by the computer, cause the computer to perform operations further comprising:

validating by matching the host name in the attribute information with a host name associated with the request.

6. The computer-readable medium of claim 1 , to store instructions, which when executed by the computer, cause the computer to perform operations further comprising:

validating the load balancer certificate signed by the certificate authority at the service virtual machine.

7. The computer-readable medium of claim 1 , wherein the client certificate associated with the application virtual machine is provisioned by an orchestrator while provisioning the application virtual machine.

8. A computer-implemented method for secure communication between processes, the method comprising:

receiving a request from a client application process hosted in an application virtual machine at a load balancer, wherein the request comprises a client certificate;

establishing a first secure communication channel between the client application process and the load balancer, wherein the first secure communication channel is encrypted with the client certificate;

terminating the first secure communication channel at the load balancer;

identifying a service process of a service virtual machine based on the request received from the client application process;

sending a new request to the service virtual machine to establish a second secure communication channel between the load balancer and the service process of the service virtual machine, wherein the second secure communication channel is encrypted with a load balancer certificate signed by a certificate authority;

validating the load balancer certificate signed by the certificate authority at the service virtual machine; and

accepting the second secure communication channel at the service virtual machine establishing a secure communication between the client application process and the service process, upon successful validation of the load balancer certificate.

9. The method of claim 8 , further comprising:

retrieving the client certificate from the request at the service virtual machine; and

validating the client certificate at an application filter installed at the service virtual machine; and

establishing the second secure communication channel between the load balancer and the service virtual machine, upon successful validation of the client certificate.

10. The method of claim 9 , wherein the client certificate comprises attribute information including at least one of a host name, an account name, an application name, permission flags and a tenant identifier.

11. The method of claim 10 , wherein validation of the client certificate is based on the certificate attributes.

12. The method of claim 10 , further comprising:

validating by matching the host name in the attribute information with a host name associated with the request.

13. The method of claim 8 , further comprising:

validating the load balancer certificate signed by the certificate authority at the service virtual machine.

14. The method of claim 8 , wherein the client certificate associated with the application virtual machine is provisioned by an orchestrator while provisioning the application virtual machine.

15. A computer system for secure communication between processes, comprising:

a computer memory to store program code; and

a processor to execute the program code to:

receive a request from a client application process hosted in an application virtual machine at a load balancer, wherein the request comprises a client certificate;

establish a first secure communication channel between the client application process and the load balancer, wherein the first secure communication channel is encrypted with the client certificate;

terminate the first secure communication channel at the load balancer;

identify a service process of a service virtual machine based on the request received from the client application process;

send a new request to the service virtual machine to establish a second secure communication channel between the load balancer and the service process of the service virtual machine, wherein the second secure communication channel is encrypted with a load balancer certificate signed by a certificate authority; and

accept the second secure communication channel at the service virtual machine establishing a secure communication between the client application process and the service process, upon successful validation of the load balancer certificate.

16. The system of claim 15 , wherein the processor further executes the program code to:

retrieve the client certificate from the request at the service virtual machine; and

validate the client certificate at an application filter installed at the service virtual machine; and

establish the second secure communication channel between the load balancer and the service virtual machine, upon successful validation of the client certificate.

17. The system of claim 16 , wherein the client certificate comprises attribute information including at least one of a host name, an account name, an application name, permission flags and a tenant identifier.

18. The system of claim 16 , wherein validation of the client certificate is based on the certificate attributes.

19. The system of claim 17 , wherein the processor further executes the program code to:

validate by matching the host name in the attribute information with a host name associated with the request; and

validate the load balancer certificate signed by the certificate authority at the service virtual machine.

20. The system of claim 15 , wherein the client certificate associated with the application virtual machine is provisioned by an orchestrator while provisioning the application virtual machine.